The background art includes intrusion thwarting systems where the computer code being attacked is a database. Such systems are called database intrusion detection systems. Some of these systems utilize offline non-real-time training in order to detect suspicious or anomalous activity. Examples of offline non-real-time database intrusion detection systems are described in Lee, et al., “Learning Fingerprints for a Database Intrusion Detection System”, ESORICS 2002, pp. 264-279, published in November 2002 by Springer-Verlag, Berlin and Heidelberg, Germany; and C. Chung, et al., “DEMIDS: A Misuse Detection System for Database Systems”, Department of Computer Science, University of California at Davis, Davis, Calif., Oct. 1, 1999.
A common flaw in database intrusion detection systems of the prior art is that such systems fail to protect the database against insider attempts to steal large amounts of data using legitimate business processes. For example, such a system may allow a given service representative to access fields and tables within the database containing customer credit card information. Normally, a representative might access 5 to 10 accounts per hour in order to service customers. That is fine until the customer service representative decides to launch an insider attack on the database, procuring large amounts of consumer credit card information, which he then uses for nefarious purposes. The present invention is designed to protect against that and other attacks.